General
-
Target
bab3da7536b417c895fdb03cdd337d3cbab1e95f89000f3722a660e2a740a93f.unknown
-
Size
565B
-
Sample
241002-bydhaathrh
-
MD5
1ad28dad1597eb28ebe2b44dea6f5140
-
SHA1
e78e5ab21c9eeb9077526a20013bef1e106b2bb5
-
SHA256
bab3da7536b417c895fdb03cdd337d3cbab1e95f89000f3722a660e2a740a93f
-
SHA512
722946e800ab329254818ca67351f3e5a5a631748eb478e5507f19aa6d636c631c1afaca93d1728e3e03f4f4a52190b93f61a03cdac61801c8f91da6dd578c79
Static task
static1
Behavioral task
behavioral1
Sample
bab3da7536b417c895fdb03cdd337d3cbab1e95f89000f3722a660e2a740a93f.ps1
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bab3da7536b417c895fdb03cdd337d3cbab1e95f89000f3722a660e2a740a93f.ps1
Resource
win10v2004-20240802-en
Malware Config
Extracted
https://finalstepgetshere.com/uploads/beta222.zip
Extracted
lumma
https://reinforcenh.shop/api
https://stogeneratmns.shop/api
https://fragnantbui.shop/api
https://drawzhotdog.shop/api
https://vozmeatillu.shop/api
https://offensivedzvju.shop/api
https://ghostreedmnu.shop/api
https://gutterydhowi.shop/api
https://pianoswimen.shop/api
Extracted
lumma
https://gravvitywio.store/api
Targets
-
-
Target
bab3da7536b417c895fdb03cdd337d3cbab1e95f89000f3722a660e2a740a93f.unknown
-
Size
565B
-
MD5
1ad28dad1597eb28ebe2b44dea6f5140
-
SHA1
e78e5ab21c9eeb9077526a20013bef1e106b2bb5
-
SHA256
bab3da7536b417c895fdb03cdd337d3cbab1e95f89000f3722a660e2a740a93f
-
SHA512
722946e800ab329254818ca67351f3e5a5a631748eb478e5507f19aa6d636c631c1afaca93d1728e3e03f4f4a52190b93f61a03cdac61801c8f91da6dd578c79
Score10/10-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-